TCP and UDP

1. Make a pool with the backend servers in it. Stream pools are separate from the pools sites use.
2. TCP & UDP, Add one.
3. Choose TCP, set the listen port, choose the pool.
4. Save and apply.

For long lived connections such as a database, least connections spreads load better than round robin.

Turn on the proxy protocol setting, but only if the backend understands it. A backend that does not will fail to read the connection at all, and the failure looks like the service being completely broken rather than like a setting being wrong.

Same steps, choose UDP instead of TCP. Health checking UDP is genuinely hard, so where the same host exposes a TCP port, check that instead.

nginx is built with the stream TLS module, so you pick a certificate the same way a site does. Useful for putting TLS in front of something that does not speak it, such as an internal service.

TCP & UDP, open the listener, and set Who can connect to an access list. Make the list first under Zones & Access, Access lists.

This matters more for TCP than for a website. A database port open to the internet is found by a scanner within hours, and unlike a web request there is no application login page in front of it doing rate limiting for you.

TCP & UDP, open the listener, and use Idle timeout and Connect timeout.

Raise the idle timeout for a database connection pool, which holds connections open for a long time on purpose and will reconnect constantly if you cut it too short. Keep the connect timeout short so a dead backend is noticed quickly.

TCP & UDP, open the listener, and tick Expect the PROXY protocol from whatever is in front.

Only tick it if the thing in front really sends it. A listener expecting the PROXY protocol header treats a normal connection as malformed and drops it, which looks exactly like a broken backend and takes a while to work out.